TCCA: An Inter-Layer Spatiotemporal Cross-Attention Network for IIoT Attack Traffic Detection

The rapid advancement of the Industrial Internet of Things (IIoT) has significantly improved operational efficiency while expanding the attack surface of critical industrial infrastructure. However, conventional intrusion detection systems (IDSs) often struggle to accurately identify diverse attack traffic, particularly minority-class and difficult-to-detect attacks. Existing intrusion detection systems predominantly rely on serial spatiotemporal architectures. These methods typically adopt unidirectional or late-fusion strategies, which limit the interaction between spatial and temporal features, while recurrent computation further constrains inference efficiency. To address these limitations, this paper proposes TCCA, an inter-layer spatiotemporal cross-attention network for IIoT intrusion detection. TCCA adopts a parallel dual-branch backbone that combines a Convolutional Neural Network (CNN) for capturing local spatial correlations with a Temporal Convolutional Network (TCN) for modeling long-range temporal dependencies, thereby avoiding sequential recurrent computation. More importantly, bidirectional cross-attention modules are integrated between intermediate layers to enable dynamic and fine-grained mutual guidance between spatial and temporal representations throughout the feature extraction process. Comprehensive evaluations on the CICIDS-2017 and CIC IIoT 2025 datasets demonstrate that TCCA achieves superior detection performance, particularly for elusive threats such as web attacks while supporting the potential for edge deployment.